Latest / Better Planner / #8 - Making Sense of Compliance | Systems, Documentation & RIA Exams
Transcript
- Taylor Stewart: Welcome back to the Better Planner Podcast. A little hiatus, but we're back at it. Colin Page, how are you? Colin: Good Taylor, how are you? Taylor Stewart: Lovely. we're good. What are we gonna say? Colin: I was gonna say it it has been a hiatus, I don't know, the whole whole summer since we recorded an episode, so how the how the heck are ya? Taylor Stewart: Yeah, yeah, life got in the way. I'm good. We've been talking. Let's not pretend that we haven't. So but Colin: Yeah. Yeah. Taylor Stewart: lots going on. Lots going on. I want to hear about what you've been g working on for the last week or so, which is the inspiration for this podcast. What have you been doing this week? Colin: I've been in compliance mode or compliance hell, however you wanna howeva however you wanna Taylor Stewart: Ha ha ha. Colin: frame it. but yeah, I mean big big news of the summer was I I just got SEC registered, so crossed Taylor Stewart: Yeah, congrats. Colin: the crossed the threshold. and so it's kind of a it's been an opportunity to like you know, step back and and s modernize or or at least bring a few things up to to Taylor Stewart: Yeah. Colin: snuff using using that as a catalyst. So so yeah, I've been Taylor Stewart: Yeah, that's what we want to do. Colin: been going through it all, compliance Taylor Stewart: Yeah. Colin: calendar, working with the consultant, filing for SEC registration, just just been knee deep in it. Taylor Stewart: Yeah, so that's what we want to talk about today was compliance and kind of how to think about it. certainly no compliance advice necessarily, but just like how to think about it, the role in the practice, what you do, outsourcing versus do DIY. Now we can talk about the differences it's early, but state versus SEC registered. And then I would like to highlight some of the differences just between the states, like my experience in Texas versus yours in Virginia. Which has been very, very different. so I want to start by saying like compliance is one of those big, scary words that I think holds a lot of advisors back. people don't do things because of compliance. And I my the way I describe it is I have a healthy respect for compliance, but no fear of compliance. I don't walk around like, compliance is gonna do that. And Part of that is just experience and having been through a number of state exams at this point. but what's your how do you you already said like compliance hell. So like that's a different thing. Nobody enjoys compliance, but like how do you think about compliance? Colin: Ooh. how do I think about it? May it it's it's about you know, at at a basic level, I just think of it as like don't do anything wrong. Like don't don't don't Taylor Stewart: Mm. Colin: be don't commit fraud, don't lie, do what you say you're gonna do, and and Taylor Stewart: Si bebé I Colin: provide good service to your clients and like that should be good enough. I think Taylor Stewart: So I think that but I think that's the problem saying don't do anything wrong. What's wrong? Here here here's what it is. Do what you say you will do in your compliance manuals. Don't say anything you can't prove. That pretty much covers it. So if you think about it, like I can't prove that the market will do eleven percent, so I better not say it will. Say it typically does or could. And if I say I'm gonna send out something once a quarter, send it. That's it. That's compliance. Colin: Mm. Taylor Stewart: For the most part. It all boils down to that. So like the like don't say anything wrong. Like what's wrong? Wrong is not doing something you said you would do, saying something you can't prove. And I I just feel like that's that kind of covers the basis. Like, is this something I can't prove with like a reliable source? If I if it is, like we can be humans, we can say stuff, you know? so Colin: Yeah. Well the the un the uncomfortable part f for me this past like week, it has been Not that so much, but it's like digging into some some of the the things that that cybersecurity and this new like reg S P and and all of that entails because I am not a cybersecurity expert. You probably Taylor Stewart: Yeah. Colin: know more about it having just, you know, gotten your SOC two certification and and Taylor Stewart: On the Cordora side? Yep. Colin: an audit completed and and you know, so I you know, I didn't know anything about those documents really before about a week ago. And so that's what like That's where I feel totally unprepared to like be the one auditing or doing due diligence Taylor Stewart: huh. Colin: on these tech companies that, you know, have access to our clients data in a lot of ways and like Taylor Stewart: Yeah. Colin: I say I'm I'm monitoring them, I say that I'm reviewing it, but am I qualified to do that? You know. Taylor Stewart: Yeah, there's a lot of transference of trust in this whole process. Colin: Totally. Taylor Stewart: and that's that's why the auditors exist is so that you don't have to. I mean, it starts with financial statement auditing, like you can trust financials because somebody you trust looked over it. SOC 2. Now, I do have some thoughts on SOC 2. kind of from three directions. I should also mention I was a former auditor in my past life. I did not do SOC two audits. I was on the financial statement side, but decent enough experience. been through it now as a company who got went through a sock to audit. doesn't mean what people think it means. I'm just gonna say that. It sock to doesn't mean like there's no risk. Like absolutely not. So it it that's a separate thing. But yeah. but you mentioned like not being qualified to do it. So are you doing it yourself? Are you getting help? Colin: Good question. yeah, I mean this guy named Claude's helping me out a lot with understanding, you know, some of these documents and some of these provisions and how, you know, how how Taylor Stewart: Mm-hmm. Colin: to understand that. And so that's that's more just you know, me educating myself a little bit. And Taylor Stewart: Yeah. Colin: like you said, yeah, you have to rely on experts and whether those are are the auditors or you know, just best practices, that that or a compliance consultant or a cybersecurity consultant that's gonna help you put those things together. yeah. Taylor Stewart: So do you have a cybersecurity or a a compliance consultant for Oakley? Colin: So yeah, I do have I I started working with a consultant about six months ago, so pre the transition to to SEC registration. But I you know, I knew that was coming. in some ways I felt like, you know, I I was I was in good shape with with the state registration, wanted to have, you know, a an expert come in and and get me ready or or or show the gaps Taylor Stewart: Yeah. Colin: f for the next stage. And actually that's that's that's a lie too, 'cause I I'd used a consultant a couple years ago just to kind of get a basic compliance system in place. Taylor Stewart: So li l can we zoom back a bit with the we both started through XYPN, kind of went through their normal process. They helped us get set up, gave us our docs, and then we've both been through our initial exam with the firms. And so but there's stuff to go through in between, but like how sorry to like but going back like when did you decide what made you decide I need some help beyond maybe what an XYPN or one of those would provide? Colin: So, yeah, I it I I had just the basic XYPN and and would join the the group calls, Taylor Stewart: Mm-hmm. Colin: the kind of ask me anything sessions with their compliance folks. And then I did pay for kinda a targeted engagement, you Taylor Stewart: Mm-hmm. Colin: know, an a a monthly retainer to to Taylor Stewart: Mm-hmm. Colin: to get a basic plan in place and then I I left XYPN earlier this year, not because of Taylor Stewart: Mm-hmm. Colin: anything wrong with what they're doing. I love XYPN, but just because my Taylor Stewart: Mm. Colin: tech stack had had had zero overlap anymore with what their their Taylor Stewart: The relationships and all the other stuff weren't worth it to you anymore. I'm just kidding. No, I get I That's right, yeah. And you're paying more for it as a non member. Yeah. Yeah. Colin: Yeah, I know, I know. I'm still going to the conference, you know. It it's it those are those are my people. Exactly. And I'm happy to. I'm happy to. Yeah, so actually one thing you said, I I have not been through an audit yet. I went I went for three years in the state of Virginia from from the launch all the way through SEC registration last month without having been audited. And so Taylor Stewart: That's my bad Okay, well we'll get to the the type of audit you did, which is actually Colin: Yeah. Taylor Stewart: okay, so that's something that has to be highlighted. Like there are differences in states on a couple of levels. How vigilant they are, do they even show up? And then what's it like when you actually get audited? so Texas has a rule where they're supposed to get to you within the first year. They came a little after a first year. I don't wanna put them s them on blast, but They're just over s overwhelmed. They're understaffed. Like they but okay, okay. So Texas tries to do that. Virginia, are they supposed to and just never did? Colin: Yeah, they told me when I first registered that they would get to me within the first eighteen months. Taylor Stewart: never did. my my dad's Colin: Didn't you know didn't happen. Taylor Stewart: been had an RAA for thirty years, and a lot of his friends have. He's been through he lived in Nebraska for a while and now in Texas. He's been through who knows what, 10, th fifteen of those, because Nebraska actually did them. I've been through four now at the state of Texas, because we did three with him. varying experiences. He's got another advisor friend who in 30 years in Illinois has never been audited. Which is terrifying. So Colin: Yeah. Taylor Stewart: it it just there is like a complete variant state by state. Something else I want to say, and this is where it's speaking as a former auditor. I always keep in mind. Those are humans on the other side of this. They're generally, there are a few on a power trip who are out to get you, but ninety-nine percent are there to just do a job. They're not trying to get you in trouble. A lot of them are trying to help you. And if you can take that posture, I mean, I remember telling them when they called us, I was like, Can't wait for you to come in and help me find what I did wrong, what I could improve. They're humans. They're not there. They're just doing their job. It's a pain in the ass job 'cause you gotta just document you're basically documenting that somebody documented that they documented something. It's just an it's an insane thing. But like, they're good people. They're not there to help you. They're they're just not. There are a few. And those are good the horror the nightmare experiences where they're stressing out over a penny here or there, something like that. But like by and large, you know, they're just there to do their job. They're there to, you know, respect but don't fear is is what I come back to on that. Colin: Yeah, I think that's that's kind of the whole way you that we should all approach compliance is is is Taylor Stewart: Yeah. Colin: you know, this is this is not something that you can do perfectly. there's always Taylor Stewart: Mm-hmm. Colin: room to improve and you know, we should all want to do better, you know, we should all want to better protect our clients' interests and their data Taylor Stewart: Yeah. Colin: and their funds and you know, so so looking at it from a positive perspective rather than just the the disciplinarian or or you know, the lawyer who's out to get ya. It you know, it's that's Taylor Stewart: Yeah. Colin: that's not been my experience interacting with the state level regulators and Taylor Stewart: Yeah, and part of it's like not i it it's just the the way they do it, like, hey, we're showing up next week. You know, now a lot of us are ver like that doesn't help them, that it's kind of this big surprise has this gotcha feel to it. Colin: Yeah. Taylor Stewart: but yeah, man, they're just just trying to make their lives easier. What do you what do you Okay, sorry, I'm just kinda going off now. Like I remember like in my last audit, they were ask they were requesting something, and it was an insane request. It made no sense why they're asking for it, it was way too much work. And Put my outer otter hat on and said, What are you actually trying to test here? And he told me, I said, Would this work? He said, Yeah. So you can also they're not dictators. It's like what they're there to Colin: Mm. Taylor Stewart: do a job, they're there to verify that certain things are done, basically complete their checklist more or less and document it. Don't be afraid to ask What are you trying to get to? There could be a better way. 'Cause I see people just yes, yes, yes, and they end up dumping loads and loads and loads of files on and a human's gotta go through that on the other end, at least used to. I'm really curious how the yeah. Colin: Yeah. Try to make it as easy as easy as possible for them to check the box and and move on to the next thing. Taylor Stewart: Yeah. And just just what do you what are you trying to get what are you trying to test in the what are trying to verify or verify testing is the word that's thrown around a lot. And we did that on the SOC two out of two. It's like, okay, what are you actually trying to test with this? Like they're asking for screenshots of all this. Like what do you need to see? And is there a better way we can show this? You know, so yeah. There's just some general Colin: Yeah. Taylor Stewart: posture on compliance thoughts. Colin: Yeah. I I can talk a little bit about my experience with the consultants and then where I think they've added a ton of value and and why like Taylor Stewart: Yeah, that'd great. Yeah. Colin: it is it is absolutely worth paying somebody who you Taylor Stewart: Yeah. Colin: know and let's be honest, mo most consultants were auditors in their in a former life and so they they know what Taylor Stewart: Yeah, yeah. Colin: what people are what they're looking for. and Taylor Stewart: Yeah. Colin: so you know, it it can really help to to have if if that's not your background, to Taylor Stewart: Totally. Colin: have somebody like that go through your your system Go through your processes, go through your documents and make sure are you actually doing the things you say you're gonna do? Which is kind of what it comes down to. Taylor Stewart: Yeah. Yeah. Colin: so yeah, where does it start, you know, We started with kind of going through my A D V. There's a lot of docum th there's a lot of a lot of things you say you do in there, a lot of policies. Do you actually follow them? Do they align with with how you're actually billing clients or what services you provide or don't provide? Yeah. Yeah, yeah. Taylor Stewart: Billing you gotta get right. There's no wiggle room on that one. You know? So yeah. Good. Colin: and then and then it came down to to the to to looking at the compliance manual. and and all of the policies and and procedures that you enumerate in there and we just did a big compliance manual update partially for going to SEC registration but partially just for you know the the the times. Like there's now an AI Taylor Stewart: Forms for your Colin: section in in my compliance manual that didn't exist before. And so thinking about you know thinking critically about what's what's in that manual and what is it what what are our policies with AI. Like do we Taylor Stewart: Mm-hmm. Colin: put customer information into a an L L or not? Or do we you know what are our what are the safeguards there that we have to follow and so going Taylor Stewart: Mm-hmm. Colin: through kind of section by section of the compliance manual was was an awesome project you know and and a refining project for for Taylor Stewart: Mm-hmm. Colin: how do we actually what what do we actually do and what do we actually say we're gonna do and are we doing those things if Taylor Stewart: Yeah. Colin: we're not doing them maybe we should change the manual and it or maybe we should be doing them. Taylor Stewart: Mm-hmm. Colin: And then the last step and this is kind of what I've been working on most recently is is is an actual compliance calendar. So that's Taylor Stewart: Yeah. Colin: that's kind of the checklist to make sure that you get to all of those things you say you're gonna do. So Taylor Stewart: Yeah. Colin: you know it's broken down by the the compliance policies and and program. Do we review all of these things on an annual basis whether it's the you know best execution or our business continuity plan or Code of Ethics, you all that stuff. You're supposed to look at it every year and attest to the fact that you're doing it. and so and one one point there, this was a huge upgrade from my compliance consultant, was putting all of those different documents into one. So I know with Taylor Stewart: Mm. Colin: the XYPN that they had a business continuity plan standalone, cybersecurity Taylor Stewart: Mm. Colin: plan standalone, code of ethics, standalone. Taylor Stewart: Mm. Colin: My consultant's like, why don't we just put these all in the same document? You know? Did they? and we started with a and we both started that's why. man. Taylor Stewart: You know what's fascinating about that? All mine came in one. Yeah. I know. At the same time. So that's so funny. Colin: Maybe I'm maybe I'm alone. That being a revelation. But Taylor Stewart: It terribly form like it like page break issues throughout, but like it was all in one long document. But yeah, that's that's inter yeah. Colin: Yeah. It makes review and attestation a lot easier. Taylor Stewart: Yeah. I think review and attestation was a lot easier when it was paper. You can just write right on it. It's kind of a pain. Like how do you Colin: Sure. Taylor Stewart: you gotta document it somewhere else now electronically that we looked at this, but yeah. Colin: Yeah. Yeah. and another point is like it comp compliance g it changes you know, there there's a big step up in the demands once you take on either an employee or another advisor. and that that was also kind of a big step up. You know, it it's no longer just me enforcing the rules on myself, which is kind of a a weird thing. You know, Taylor Stewart: Yes. Yes. Colin: of course I'm not going to send PII and an unsecu or send send sensitive information outside an email, but now I've got to make sure or it's gonna be outside of a secure email or or s delivery service. But now I've got to make sure that My employee is not doing that and how do I Taylor Stewart: Yeah. Colin: how do I verify that? Well now I need a system to make sure that they're actually, you know, doing what they're supposed Taylor Stewart: Yeah. Colin: to do. So it gets way more complicated once you start to have to monitor other people. Taylor Stewart: Yeah. I mean I think that's most most of compliance and auditing in general is like is just not meant for the small and solo businesses and shops. I mean, I'll tell you from the SOC two stuff we did on Cordora's like this would make a lot more sense if we had multiple offices and a huge team. But it and it's a like that's where a lot of that annoyance comes from 'cause it's I reviewed myself. You know what I mean? Or you Colin: Yeah. Taylor Stewart: know, like the same person reviewed something. But what about what have you noticed? 'Cause like the the attitude I've always heard is compliance gets a lot easier once you're SEC registered. Colin: Hm. I thi i i y in some ways, you know, I and I'm speaking from from I haven't had a ton of experience yet, but but Taylor Stewart: Yeah. Colin: I think th th some of the things you already mentioned with was these state regulators are overworked. you know, that the that they may not have as much experience as as the folks at the SEC or their rules are not as streamlined and so there could be some more variability in terms of the responses that you get or the the types of of requests you have. Whereas I feel like the SEC to a to a large extent is And this is probably true for the state auditors too. They're not really coming after fee only advisors like you and me for for for you know, they're they're mostly out there looking for insider trading or major fraud and and and that sort of thing. And so you're just not as much of a target. you're not their main main target, perhaps. for me, you know, one thing that definitely got easier, and then this is a state specific thing, Virginia did doesn't follow the the the safe harbor or no action letter around standing letters of author authorization. You know, there's some exceptions when you want to transfer funds from a client to a third party, even if that third party is like their joint account with their spouse. Taylor Stewart: Yeah, so so basically for a a normal move money authorization to move money from a brokerage account to a checking account, you had to go through a custody audit, right? That's insane. That's insane. Colin: I had to go through a custody audit. Yeah, Virginia viewed that as being custody. Yeah. Taylor Stewart: Like that's that's just Colin: so yeah, that that was a seven thousand, eight thousand dollars a year saved now that have to go through an exam anymore. Taylor Stewart: Get this. you said it. Like that's that's the type of stuff like just mmm I'm sorry, man. I still can't believe that. Colin: Yeah. No, I I and it actually wasn't until I'd been registered for a year that that when I went to submit my my updated A D V, my new annual update that the the guy reviewing it came back and by the way it looks like you are are you have these standing letters of authorization in place. Are you doing a custody audit? And I said, excuse me. Taylor Stewart: Yeah. Colin: I I no. Taylor Stewart: Yeah, yeah. Colin: so yeah. Th that that for me will be easier, you know, the advertising rules, Virginia again didn't follow the SEC's Taylor Stewart: Testimonials. Colin: guidance testimonials and and and advertising. So so that's something I'm now allowed to do that I wasn't able to do. Taylor Stewart: Yeah. Colin: but I have I have thoughts on on whether that you know that sort of thing is even you know, how how much value that really is anyways once Taylor Stewart: Which part? Colin: you're established. The testimonials and and it's not a compliance thing or anything but Taylor Stewart: You don't think testimonials are valuable? Colin: I I just don't like I th I I think Taylor Stewart: What part do you not like? Colin: I don't like asking for Taylor Stewart: You don't have to ask for I've never asked for a testimonial. Colin: Yeah. it just I I don't know. I Taylor Stewart: You're not gonna have a QR code with at the in your office, like please leave us a review on Yelp. Google. I I mean I think I think it's one of the greatest things you can have happen. Especially if they're real. Like, I mean Colin: No, I'm not going to. Yeah. Sure. Taylor Stewart: the way I think about it is like any any testimonial or something put somebody puts on a website, if it's been formatted, then it was tray picked. which you can't do. You're not supposed to w with the testimony. This is supposed to be fed in from something. So like wealth tender is a great example. And yeah, there's probably, you know There's like that thing of like you need to see at least one bad review for you to know it's real. You know, like eighty it's like eighty six five star reviews is less believable than eighty five five stars and one one star. You know, like there's so but I mean I it can't hurt. It literally can't hurt. It may not Colin: Yeah. Taylor Stewart: you may not need it, but there's like almost nothing bad that can happen from good testimonials. But Colin: That that's probably true. It's it maybe it's personal preference for not wanting to see it like front and center on your website or anything like that. Taylor Stewart: Do you leave a Google review on anything? This is okay, I total side note, but like since I got my fur I I didn't ask for it. A small business owner client I worked with left me on a g review on Google. I was like, cool. I was like, Wow, that was really nice. So now if I go to like a small business, I almost always leave a review. It helps. Colin: Yeah, I d I do when they ask, but I don't do it as a regular course. restaurants, yes. Anything but Taylor Stewart: Do you look at reviews when you check out a place or a business or anything? Restaurant? Yeah. Colin: a restaurant, no. 'Cause they're they're just I I I and I just don't trust reviews, 'cause like you're either gonna get like five star reviews from their friends, or you're gonna get a one star review from a disgruntled customer, you know, who may or may not or a competitor, yeah. Taylor Stewart: Or competitors. I'm ninety nine percent sure like like competitor restaurants comment on each other. yeah, that's interesting. I was gonna say something else on that. Okay, well anyway, so now you can do them if you want. You don't have to. Colin: Yeah, now I can do whatever I want. Taylor Stewart: Nice. what else is different? I mean, you still gotta say what you can pro you know, say stuff you can prove. Do what you say you'll do. somet okay, so you taught mentioned like updating the ADV yourself. I think that's kind of like a black box for people of like you can actually Colin: Mm. Taylor Stewart: log in and do it yourself. You you inspired me. Yeah. Well, you inspired me to do that. Cause Colin: And I have a couple of times, yeah. Yeah. Taylor Stewart: I was like, that's crazy. Then I was like, I mean the form kind of sucks online. It was that through the Finra website, right? Finra.org website. Yeah. Colin: Yeah. Yeah, the part one form is a little Taylor Stewart: yeah, but it is also all there. You can just do it, you know. Colin: Yeah. Yeah. Taylor Stewart: which is kind of cool. I mean, I would still gladly pay somebody to not have to log in and do all that, but like it's okay, you can make those changes. Colin: Yeah. Yeah, and I think the first time I did it was a was over a a fee model change. You know, I started I started as an AUM fee and and you talked me into switching to flat fee and that that already like aligned with kinda how I viewed the advisor's value. That's a longer story. But but Taylor Stewart: Mm-hmm. Colin: but yeah I made that change myself. Found found you know I might have downloaded your ADV and copied the the language from it, you know. Taylor Stewart: Yeah. Colin: you know find the A y that that's one of the great things is whenever somebody comes to me with an advisor I go check out their ADV Taylor Stewart: Exactly. Yeah. Colin: first thing just say what am I what am I what am I working? Taylor Stewart: Well and that's a great point too. You can look at other filed ADVs language. How do you describe Colin: Yeah. Yeah. Taylor Stewart: this? So like I don't know how often it actually happens now, but like it no, it's real. Like they Most of the it's more of an exam than an audit. I think that's actually the the proper term is it's an exam of like your compliance. but like appropriateness of compensation comes up. Did you ever get any questions about like the fee you're charging? that brought up another thing. Go ahead. Colin: from from the the regulators? Taylor Stewart: Yeah. Colin: No. I mean i they they did wanna make su so so that mo most regulators are not that familiar with flat fee. It's kind of a newer thing. And so so they did want to make sure Taylor Stewart: Yeah, that's what I was gonna get at. It's like just kinda breaks the brain a little bit. Yeah. Colin: they did want to make sure that I'm not charging anybody more than three percent of any account that I'm managing. You know, 'cause I do pull my fees directly from the the client account. Taylor Stewart: Mm-hmm. Colin: So they did have me add some language in there, like, and you're not going I'm not going to pull more than three percent, you know. So I do have to check, you know, and and I know there there isn't anybody that that Taylor Stewart: Well, I mean, but even to get ADVs approved, so this is this Colin: That's like that, but Taylor Stewart: brings up a two-part thing. So like you put your fee range on your ADV. Right? You're like, this is what I'll charge for different services. Something I did not know, don't hold me to this, but it was told to me by a Texas regulator, is that it's just a range. You can go above it. But just don't consistently go above it. I didn't freaking know that. So if you say, you know, somewhere between like two and twenty-four thousand, you can charge somebody fifty thousand dollars. You don't have to update your ADV to do that. Colin: Yeah. Taylor Stewart: I didn't I had no clue. Again, check with your state regulator on that one, but that was communicated to me. But like I that that's brought up some some of the tricky things. Like I know hourly, a lot of hourly engagements, like the states have some some caps on that, and then you can get into the issue of like what's your hourly rate on certain AUM engagements and why is that okay? And like I think that's a tricky area for the regulators to get involved in. 'cause you're kind Colin: Yeah. Taylor Stewart: of like getting into like price setting there, which is Colin: Mm-hmm. Taylor Stewart: Not bad. Our industry deserves to be monitored. But with you if you get into more of the FIFA advice directly, the value equation is just not the same. I mean, or just the the the pricing model's just not the same. And it's just really tricky. Like You could justify a ten thousand dollar hourly fee. Depending on the work you're doing. Why not? But you could never get that approved. So that's just that's Colin: Yeah. Taylor Stewart: kinda separate, but but they didn't Colin: Yeah, and I know certain states are are infamous or famous for being very difficult with th how you charge, you know Washington State being one, California being another, whereas it's tricky for folks that charge for advice only or they're having to jump through extra hoops to document, you know, how many hours they're actually spending on the client for a flat fee. and that's you know, that's whereas, you know, no problem if you want to charge two percent of assets, like go ahead. And and Taylor Stewart: Yeah. Yeah. Colin: only, you know, meet with the clients once a year, that's fine. But Taylor Stewart: Really. Yeah. Colin: if you want to charge a flat fee, now you gotta document exactly how many hours your your you're working for them and and that sort of thing. That you're doing something for them every you bill monthly, that you're doing something for the client every month. and so that was one change that we made on our AD V is that it we say our fees annual build monthly, but you know, not not a monthly ph fee. 'cause they wanted to see some kind of alignment with the service you're providing, you know, so if you're billing monthly, what are you doing this month for this client, you know? Taylor Stewart: that's such a like that's such an insane intervention bias. Like you have to do something to justify your feet. Like that is Ugh, so dumb. I get I get where it comes. Yeah. We can't because like sometimes doing nothing is the right thing. And what if you you Colin: Yeah, versus there's no justification if you're just charging for managing, you know, a as it's under management, but yeah. Taylor Stewart: met a ton in one c I mean we know in reality that that's just not how the world works. It's not like you do the same amount every single month. Yeah, that's interesting. Yeah, I would say like I I mentioned earlier, Billing's gotta be right. That gets heavily scrutinized. Like to the penny, actually. So like Colin: Yeah. Mm-hmm. Taylor Stewart: you gotta make sure. And that's where you know, the more complex your fee model, just make sure you make sure you can prove it. Just make sure you can show show the calculation and it all ties back to reliable source data. And it's fine. Colin: Yeah. Yeah, i i that that's one area where flat fee billing makes it so easy because it's Taylor Stewart: Yeah. Colin: literally just plug in the amount and I d I mean I I use UltraWist and so it it it calculates the fee automatically and and you know, you can say which accounts you want to bill and which accounts you want to not bill. So for example, you know, I bill and I think a lot of advisors do this, they won't they'll bill the fee that's owed to the Roth account, bill it to a taxable account or a cash account. So I do I do that, but you know, technology makes it so easy to to do that and Taylor Stewart: That's nice. Yeah, I mean feed billing softwares are still a thing. It used to be a very expensive standalone tool and was a big deal. And Colin: Yeah. Taylor Stewart: yeah. I mean, I remember looking envelopes to mail those as a kid sometimes for clients. Performance reports, all that stuff. Golly. Filing cab like that's where like I think back like one of my intern jobs in college was digitizing the filing cabinets in the office. 'Cause they had to have years and years of r years of records. It's like, my gosh. A whole room Colin: Yeah. Taylor Stewart: of literally just filing cabinets of notes and illustrations and performance and statements and it's like it's so freaking easy now. Anytime Colin: Yeah. Taylor Stewart: I hear people complain about tech, I'm like, Good Lord, it's unbelievable. Colin: Ha ha. Taylor Stewart: Unbelievable right now. Colin: Yeah. And it's freeing 'cause I don't I I don't provide performance reports. I mean the client can log in and see what their performance is and Taylor Stewart: And you don't have to. Yeah. Colin: and you don't have to as long as you don't say you do. If you say you provide a performance report you better do it. But Taylor Stewart: Exactly. That's what I'm saying. You can say we don't that was something I learned when we got registered, it like, Do want to send them? I Colin: Yeah. Taylor Stewart: like, quarterly, like you better do it. And I Do I have to? They said no. I was like, then no, we're not sending performance reports. It's just like Colin: Yeah. Taylor Stewart: and clients don't ask for They don't the way I present things, they don't care. So Yeah. anything else on compliance? Compl let Colin: Yeah. Taylor Stewart: me c kind of summarize where we're at. Like respect but don't fear. do what you say you will do. Don't say anything you can't prove. Outsourcing a compliance consultant, extremely worth it in your opinion. Colin: Yeah. Taylor Stewart: Ross. Colin: Yeah, figure out a calendar. you know, figure out when you're actually gonna do the things you say you're gonna do. Taylor Stewart: Yeah. Colin: and that has to be like it has to be put into your CRM. You know? You Taylor Stewart: Mm. Colin: y you need a you need something that's gonna remind you, okay, now it's time to do your work. vendor due diligence. You know, the things Taylor Stewart: Mm-hmm. Colin: you have to do on an annual. Or now it's time for you know, my my assistant just gets a a pop up every quarter. Now it's time for her to upload financial state her own like in investment account statements for the transactions review and reporting we have to Taylor Stewart: That's great. Colin: do or monitoring. so as much as you can get that compliance calendar into a CRM or or you know, so you can automate that or offload it to to you know, that's something I'm working on now is what what of this could I could I actually have my assistant help me with gathering Taylor Stewart: Mm-hmm. Colin: documentation for performing certain functions. but yeah, get get actually get organized. Otherwise you probably won't get to all these things that you say you're gonna do within the year. What else? Taylor Stewart: What do you use for the compliance calendar? Does your con consultant give you that? Colin: Yeah, so she gave me a big Excel spreadsheet. You know, it's broken down into to maybe five or six categories or like groups of of things like security and technology or regulatory filings and disclosure documents or portfolio management and financial planning tasks that we have to do. you know, and each each task has a description and then a a frequency that you need to do it and a reference, you know, to some some rule or requirement, r you know, whether it's from the compliance manual or it's certain custody rule or or whatever. so that that's been and then I use that act that document or I'm I'm going to be using that to document when we did these things. And so there's a column for date completed, a column for location for supporting documents. And so I literally just paste in the link to, you know, here's my here's my compliance manual here's the attestation that that you know my my assistant signed or whatever and then any findings or comments and that's my annual review is is just this basically this Excel document. Here's here's all the things I say I'm gonna do, here's when I did here's anything I found while I did it. Taylor Stewart: That's awesome. I'm trying to find this one email from an auditor that it was like the most auditing Basically it was something like, Do you have documentation of your documentation that you documented? That's just like I was like I took a screenshot, I was like, my god. That's amazing. That's all it is. Colin: Yeah, I know no compliance consultant or or person is gonna tell you to document less. They are always gonna tell you document more. Yeah. Taylor Stewart: They have to document that they went through your documentation. That is literally what it is. Colin: Yeah. Taylor Stewart: I mean somebody's gotta do it. It serves a role. it's a nightmare of a job, but you know, if it works it does it w Colin: Yeah, I mean I'll tell you one one thing that has made compliance better in my view is actually AI. Taylor Stewart: Mm-hmm. Colin: Whether it's and it has made and it's because it makes it easier to document things. And so, you Taylor Stewart: Mm, yeah. Colin: know, I I whether it's recording and and outputting meeting notes, Taylor Stewart: Yeah. Colin: you know, there's a there's a section. So I have a prompt for my meeting notes and in that is a section on investment recommendations. And so the the AI is looking for any time I've made an investment recommendation or a change to our investment policy, it's gonna call out specifically what was that change, what were we doing before. What was the rationale? Were there any counter arguments considered? That's the kind of stuff that if I were taking notes by hand or having to write up my notes after the fact, like that just wouldn't happen. Or maybe you could do it for something like that, but capturing capturing all those areas where you know to show that you talked about certain things or analyzed certain risks with the client. Now I have it in my note with a timestamp from the transcript, you know. So so I feel like that that AI has has really made documentation easier and I'm using it now with with the vendor due diligence. You know, I can go find the SOC two report for Altruist and upload it's my contract you know I can't upload the SOC two, that's private, but you know, I can upload the the the key documents from it and and get a a reasonable summary and and call out of areas that I should probably be looking at or or making sure that I'm doing certain things or have certain policies set up. you know, I created a a compliance folder that I gave Claude access to where I have Taylor Stewart: Mm-hmm. Colin: saved in there my privacy policy, my compliance manual, my ADV, my client agreement. and so whenever I have a compliance question, like I've got an AI expert now on on my documents. Taylor Stewart: Mm-hmm. Colin: and so that that's been that's been something that that's made it a easier. You know. Not not that that's Taylor Stewart: That's awesome. Colin: gonna be the final say on anything, but but it's hugely helpful for orienting yourself or or at least knowing what to think about. Taylor Stewart: Yeah. Yeah, I think I think the first thing you said was like getting getting familiar with things. It's great at that. Turning that legal ease into like what the hell does this mean? Colin: Yeah. Taylor Stewart: That's good. Colin: What else? We Taylor Stewart: I don't know. How Colin: we may have exhausted my knowledge on on compliance. Taylor Stewart: Yeah, the vendor due diligence like What are you looking for? Yeah. Colin: I think I texted you yesterday, icause I had this list of documents that that You know, we're supposed to get, you know, we should we should Taylor Stewart: Yeah. Colin: be capturing those SOC two reports. We should have our contract on file and understand the the vendors' privacy Taylor Stewart: Yeah. Colin: policies. What are they doing with your data? And I texted you yesterday, like, do you have a trust center? 'cause I think I just learned that those exist for a lot of these tech firms. Taylor Stewart: Yeah, so I'll I'll tell you j a little bit like how that works. there are services it's very confusing. The most popular one is Vanta and they help tech companies get ready for their SOC 2 audits or whatever else audits. And they're not the auditor. This is where I'm gonna probably share too much. Like they shouldn't be, but the inner d dealing is horrible. You've got a company that's job is to help you get ready for an audit. That your ex they pitch it as like do almost nothing and get SOC 2 compliant. so they're basically directly tied to the success of the audit and it creates this horrible incentive system where like the auditor might get kicked off the platform if they don't approve audits. So it's a whole mess. Colin: Mm. Taylor Stewart: but yeah, so you most of these all of these companies provide a like trust center that you can put on yours. So ours is trust dot corridora dot com. That's a pretty reliable URL for most companies, but you can just search like a trust center and that's where all the documents are on there and then you can request access and we don't do anything. It just it's all handled by the provider. I approve anybody who wants access to it, so it's not just anybody off the street because those SOC two reports actually do have a fair amount of like inner working information. and yeah, you can learn a lot from there. And just just so you know, like a large portion of our SOC two is gathering the SOC two from the people we use. Colin: Mm, mm-hmm. Taylor Stewart: It's it's there's there's a lot of documentation around like meetings and reviews and then some security practices and things of that nature. so but it's Colin: Well and that's just the world we live in that that all of these Taylor Stewart: yeah. Colin: tech firms rely on other firms to provide certain services to Taylor Stewart: Totally. Colin: them and you're you're only as strong as the weakest link. And so I I Taylor Stewart: Yeah. Colin: I think I I came into this process or or you know, thinking about this, like how how are we expected, me as an advisor, how am I expected Taylor Stewart: Exactly. Colin: to have any knowledge in this area and be able to hold or you know, go to Google and say, Where's where's your privacy policy or and have any chance of negotiating a any term on the contract? Like zero. We're price takers. Taylor Stewart: Yeah. So I w Colin: we we take the contract but but I would say that like this process has made me appreciate like how much is it involved and in a way it's kind of genius because now these companies have all these different advice I'm talking about like the reg SP you know we have to verify that that companies will will tell us of a breach or notify us of a breach within 72 hours. Well now the the Taylor Stewart: You require that now? Colin: well we're supposed to And and if if you know, I can't go to Google and make them change their contract to to do that. But the fact that Google or all these other, you know, sp financial planning tools, CRMs, whatever, the fact that they're getting these emails from advisors asking about it, like I bet that's gonna have a big accumulative effect on on maybe them changing their policies to make sure, you know, that that they can Taylor Stewart: Yeah. Colin: answer those questions well. Taylor Stewart: Yeah, so a lot of a lot of like bigger REAs will send a questionnaire that we need to populate. Colin: Yeah. Taylor Stewart: And don't worry, there's AI tools by the providers to answer those based on your documents. But Colin: Yeah. Taylor Stewart: some sometimes like I I think that's the best way of like you have a due diligence checklist that you're scanning for, you send it to them, they fill it out, you populate it. some of them go way too far. Like it was asking about like DEI pra hiring practices, which I want to get into that, but it's like that has nothing to do with Anyway, so like but yeah, I mean some answer just figuring out like what your basic questions are and getting those answered is is good. I mean you you're not gonna get Google to change anything, but you could ask we have people ask us to like modify a term for an agreement and we can do it. Colin: Yeah, and that's that's actually that brings up another key point about compliance. And then I've heard this from compliance consultants and and probably other other sources as well. But like y what what you should be doing as a solo RIA or a small firm, versus what a mega RIA should be doing are very different things. And and the SEC or the state regulators, they don't necessarily expect the small solo RIA to have the same compliance and security and and due diligence process that a larger firm has. And so a lot of this is governed by like what are your resources and what can you reasonably expect someone like me who's not super tech sophisticated. to be able to actually do or or what kind of weight do they have to actually dictate terms or changes in their agreements or or you know, so a lot of it is is is also geared to what's your size and sophistication and and how complex your organization is or how many people do you actually have under you dictates what kinds of verification and and you know monitoring y systems you need to have set up. Taylor Stewart: Mm. Yeah. Yeah, I think like yeah, the more com more into it you get, you could have different things 'cause like SOC two compliance doesn't mean like perfectly secure. it just means they satisfied certain requirements. And so you could have Like we've gotten approved for things before we had it too, 'cause they had their own questionnaires and they wanted to see proof of certain processes. Like that's where like compliance is mostly a mindset. Like being audited for anything doesn't mean you're not doing anything wrong. And so, just I would say still just take a little bit of a critical eye. But also it's a balance. You can't verify everything yourself or be expected to, so Colin: Sure. Taylor Stewart: Cool man. Fun stuff. Well, how much longer you got on your compliance work? Colin: that's that's one of the dangers of AI is it does kind of allow you to go in much deeper than than I would have otherwise, but hopefully hopefully handing some of this off to my assistant in the coming days and and Taylor Stewart: Days. man. Colin: or or yeah day and and then step back to more of a reviewer. We'll see. Taylor Stewart: Well good luck and have fun. Colin: Yeah, I'm lear learning a ton. Taylor Stewart: Good. That's good Colin: Yeah. Taylor Stewart: stuff to know. Awesome man. Well, good to be back. Thanks for the insight as always. See you. See you next time. Colin: Likewise, yeah. See ya next see ya next time.